Windows Kerberos CVE-2026-69760

No special conditions are required beyond network reachability to the Windows Kerberos service on TCP/UDP port 88. The CVSS PR:N confirms exploitation requires no authentication. The vulnerability is present in default installations of all affected Windows versions when joined to or operating as a domain (where Kerberos is the default authentication protocol). Exploitation is limited to availability impact only - no confidentiality or integrity impact is present per CVSS C:N/I:N. Non-domain workgroup configurations where Kerberos is not actively in use may have reduced exposure, but the service is still present on affected Windows builds.

The CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects a straightforward, unauthenticated network DoS against a widely exposed service. The absence of a CISA KEV entry and no reported POC code tempers urgency somewhat, though the low attack complexity and zero authentication requirements mean this is highly automatable and represents a real operational threat - even a mid-sized municipal IT team in kalisz should treat this as urgent patching work given the breadth of affected Windows builds. The Kerberos service (TCP/UDP 88) is directly Internet-facing in some environments and universally reachable within domain networks, expanding the attack surface considerably. The 'Information Disclosure' and 'Buffer Overflow' tags in the metadata are both inaccurate (the CVSS confirms C:N and CWE-125 is a read, not a write), so those signals should not factor into risk decisions. EPSS data is not available in the provided intelligence; prioritization should rely on network exposure of port 88 and criticality of authentication infrastructure.

An unauthenticated attacker on the network sends a malformed Kerberos AS-REQ or TGS-REQ packet crafted to trigger the out-of-bounds read in the Windows Kerberos service. The memory violation causes the Kerberos service to crash, rendering the host unable to authenticate users or process Kerberos tickets until the service restarts. In an Active Directory environment, repeated crashes against a domain controller could disrupt authentication for an entire organizational unit.